Chrome lets you disable the V8 optimization to improve security

Chrome’s V8 JavaScript engine plays an important role in optimizing website performance, but like any complex software, it requires ongoing security updates and improvements. To give users more control, Google is testing a new security setting for V8 called V8 Optimiser in Chrome 122 (currently in beta). This setting allows users to selectively disable V8 optimizations on specific websites, potentially enhancing security while minimizing potential performance impacts on trusted sites.

What is V8 and why it is important?

V8 is the JavaScript engine powering Chrome and many other Chromium-based browsers, including browsers like Microsoft Edge, Brave, and Vivaldi. It plays a crucial role in website performance by optimizing and executing JavaScript code efficiently. These optimizations, known as JIT (Just-in-Time) compilation, enable faster page loading and a smoother browsing experience.

Imagine websites without the smooth animations and interactive features you’re used to. That’s where JavaScript comes in! It’s the code that makes websites interactive and animated, and V8 ensures it runs super fast, giving you a seamless browsing experience.

While V8 optimizers improve performance, they can also introduce potential security vulnerabilities. Attackers might exploit these vulnerabilities to inject malicious code or manipulate data in the browser. Recognizing this risk, browsers like Microsoft Edge have implemented features like Super Duper Secure Mode (SDSM) or Enhanced Security Mode, which disables JIT compilation altogether, prioritizing security over performance.

Chrome’s new V8 optimiser Security Setting

Google has added a new setting to Chrome’s security settings (chrome://settings/security) called V8 Optimiser that allows you to disable V8 JIT optimizers if you prefer enhanced security in Chrome over performance. This setting may be available with Chrome 122.

You can find it by visiting Menu > Settings > Privacy and Security> Site Settings and expanding additional content settings.

Here are the two options available under V8 optimiser:

1. Sites can use the V8 optimiser: This is the default setting, turned on by default.
2. Don’t allow sites to use the V8 optimiser: As the setting describes, enabling it may slow down websites, but it makes V8 more resistant to attacks.

Chrome also lets you control individual website performance and security by including them in a custom list for allowed or disallowed optimizations.

While disabling V8 optimization reduces the attack surface for certain vulnerabilities, potentially making it harder for malicious websites to exploit the engine. However, it can also lead to slower website loading times and reduced responsiveness, impacting your user experience.

This feature is currently being tested in Chrome beta and is likely to ship with the Chrome 122 release. The new “V8 Optimiser” security setting lets you choose between faster websites and better security.